CVE-2025-59185
Unknown
Unknown - Not Provided
BaseFortify
Publication date: 2025-10-14
Last updated on: 2025-11-05
Assigner: Microsoft Corporation
Description
Description
External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| microsoft | windows_10_1507 | to 10.0.10240.21161 (exc) |
| microsoft | windows_10_1507 | to 10.0.10240.21161 (exc) |
| microsoft | windows_10_1607 | to 10.0.14393.8519 (exc) |
| microsoft | windows_10_1607 | to 10.0.14393.8519 (exc) |
| microsoft | windows_10_1809 | to 10.0.17763.7919 (exc) |
| microsoft | windows_10_1809 | to 10.0.17763.7919 (exc) |
| microsoft | windows_10_21h2 | to 10.0.19044.6456 (exc) |
| microsoft | windows_10_22h2 | to 10.0.19045.6456 (exc) |
| microsoft | windows_11_22h2 | to 10.0.22621.6060 (exc) |
| microsoft | windows_11_23h2 | to 10.0.22631.6060 (inc) |
| microsoft | windows_11_24h2 | to 10.0.26100.6899 (exc) |
| microsoft | windows_11_25h2 | to 10.0.26200.6899 (exc) |
| microsoft | windows_server_2012 | r2 |
| microsoft | windows_server_2016 | to 10.0.14393.8519 (inc) |
| microsoft | windows_server_2019 | to 10.0.17763.7919 (exc) |
| microsoft | windows_server_2022 | to 10.0.20348.4294 (exc) |
| microsoft | windows_server_2022_23h2 | to 10.0.25398.1913 (exc) |
| microsoft | windows_server_2025 | to 10.0.26100.6899 (inc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-73 | The product allows user input to control or influence paths or file names that are used in filesystem operations. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves external control of a file name or path in the Windows Core Shell, which allows an unauthorized attacker to perform spoofing over a network.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability could perform spoofing attacks over a network, potentially misleading users or systems by presenting falsified information related to file names or paths. This could lead to security risks such as phishing or unauthorized access attempts.
Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70